rx[.]rar | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
rx.rar
Size 20.0MB
Sample261030-cdz18ada63
SHA256 6ccfb5e3ed460d8770464e8bb77d2b75900bc73bb7cae5b22dd55dd080a0f59c
MD5 be2dba70ec8a3a4dc5bdc49b7b7507f5
SHA1 5cb053e01117407de3cfa5992fa7d4d27becaa9f
SHA512 49340602aba9d80ce3d0a6e1064a6aaee8a030ed1ae603098cd0dcdf4fa7ae4daa7cdb76f2efc059d0acf7bf9f043b8619833f599bb6eacbb238881420d6b596
SSDEEP 393216:noQhJ9PAPI+eb/N1PB6aOkNzuuTQZGCbKP6nUkMoWSHcy2c5rpS:noRCbVhVNKSQZLWCnUjvSHP2chg
TLSH
T18A2733BC2ACD6299B2D663C67F402521D8CA9CA33FEDE5F540B2CD874744C81CB2AD65
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Rx woofer crack.exe

File Explorer

rx.rar

.rar 20.0MB
Rx woofer crack.exe

.exe 9.6MB
ss.exe.i64

52.9MB

rx.rar

SHA256 6ccfb5e3ed460d8770464e8bb77d2b75900bc73bb7cae5b22dd55dd080a0f59c
MD5 be2dba70ec8a3a4dc5bdc49b7b7507f5
SHA1 5cb053e01117407de3cfa5992fa7d4d27becaa9f
SHA512 49340602aba9d80ce3d0a6e1064a6aaee8a030ed1ae603098cd0dcdf4fa7ae4daa7cdb76f2efc059d0acf7bf9f043b8619833f599bb6eacbb238881420d6b596
SSDEEP 393216:noQhJ9PAPI+eb/N1PB6aOkNzuuTQZGCbKP6nUkMoWSHcy2c5rpS:noRCbVhVNKSQZLWCnUjvSHP2chg
TLSH
T18A2733BC2ACD6299B2D663C67F402521D8CA9CA33FEDE5F540B2CD874744C81CB2AD65
MD5 SHA1 SHA512 SSDEEP TLSH

Rx woofer crack.exe

IMPHASH cb9c0f6bf2e2e02b385557acdd6f607e
SHA256 16014d788a6928f68e0e96f154784379ef9b048c117bc3ecbdf3a8177def23d1
MD5 26953cb0809347fc779f2382513c3566
SHA1 43367b8e46174abf6f1d205308ea080c2baad5c7
SHA512 0463bb59d7b2574da1036d2aafc6c0e96d3498cc171cd470ebca879a07fbcb28fcd80da00a009a267b8f4b60fc29eaa3a80dd8548302ed820fb567e0b3c6c5e1
SSDEEP 196608:bvb9Z/PLEKLJ9hZ8w6Qp3BVzMHF/3+ppi:r7/PLNhZ84rVzeF/uX
TLSH
T177A61243E3E9415AD023A638C742971BE3727418073487DBBFD4195EDBAB9E0AB76B40
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1050968

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\flash\Desktop\spoofer\loader sapphire\thirdparty\imgui\examples\example_win32_directx11\Release\example_win32_directx11.pdb

ws2_32

WSACleanup closesocket inet_pton WSAStartup send socket connect recv htons setsockopt gethostname

ntdll

NtUnloadDriver RtlAdjustPrivilege RtlCaptureContext NtLoadDriver RtlInitUnicodeString RtlLookupFunctionEntry RtlVirtualUnwind NtQuerySystemInformation

wininet

HttpSendRequestA InternetReadFile InternetConnectA HttpOpenRequestA InternetCloseHandle InternetOpenA InternetOpenUrlA

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_43

D3DCompile

dxgi

CreateDXGIFactory

kernel32

SetUnhandledExceptionFilter IsProcessorFeaturePresent GetStartupInfoW GetModuleHandleW GetSystemTimeAsFileTime AreFileApisANSI LoadLibraryA GetProcAddress FreeLibrary GetVolumeInformationA WaitForSingleObject Sleep CloseHandle GetSystemInfo GetCurrentProcessId GlobalMemoryStatusEx CreateProcessA MoveFileA GetTempPathA CreateThread GetCurrentProcess GetModuleHandleA GetCurrentThread QueryPerformanceFrequency GetThreadContext QueryPerformanceCounter IsDebuggerPresent CheckRemoteDebuggerPresent GetModuleFileNameA Process32First Module32Next Module32First CreateToolhelp32Snapshot GetSystemDirectoryA Process32Next GetWindowsDirectoryA GetSystemWow64DirectoryA ExitProcess TerminateProcess SleepConditionVariableSRW WideCharToMultiByte ExpandEnvironmentStringsA CreateMutexA GetLastError OpenMutexA GetConsoleWindow MultiByteToWideChar GlobalAlloc GlobalFree GlobalLock GlobalUnlock GetLocaleInfoA VirtualProtect SetLastError FlushInstructionCache SetThreadContext FindFirstFileW VirtualFree FindNextFileW DeviceIoControl VirtualAlloc FindClose CreateFileW GetCurrentThreadId DeleteFileW GetTempPathW GetWindowsDirectoryW InitializeSListHead LocalFree FormatMessageA GetLocaleInfoEx FindFirstFileExW GetFileAttributesExW UnhandledExceptionFilter WakeAllConditionVariable AcquireSRWLockExclusive ReadProcessMemory SetFileInformationByHandle ReleaseSRWLockExclusive CreateFileMappingA UnmapViewOfFile MapViewOfFile HeapFree HeapAlloc GetFileInformationByHandleEx ReadFile GetFileSizeEx OpenProcess CreateFileA

user32

DestroyWindow CreateWindowExW GetSystemMetrics UnregisterClassW RegisterClassExW SetLayeredWindowAttributes TranslateMessage PeekMessageA DispatchMessageA GetKeyState GetMessageExtraInfo LoadCursorA ScreenToClient GetCapture ClientToScreen TrackMouseEvent DefWindowProcW GetKeyboardLayout GetForegroundWindow GetCursorPos UpdateWindow MoveWindow GetAsyncKeyState GetWindowRect PostQuitMessage MessageBoxA ShowWindow SetClipboardData GetClipboardData EmptyClipboard CloseClipboard OpenClipboard SetCursorPos ReleaseCapture IsWindowUnicode GetClientRect SetCapture SetCursor

advapi32

RegDeleteValueW RegSetKeyValueW RegDeleteTreeW RegOpenKeyExA GetUserNameA RegQueryValueExA RegCloseKey RegOpenKeyW RegOpenKeyExW RegCreateKeyW RegSetValueExW

shell32

ShellExecuteA SHGetFolderPathA

msvcp140

??1_Locinfo@std@@QEAA@XZ ?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ ?_Incref@facet@locale@std@@UEAAXXZ ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ??0facet@locale@std@@IEAA@_K@Z _Query_perf_counter _Mtx_lock _Thrd_id _Thrd_join ??0_Locinfo@std@@QEAA@PEBD@Z ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ??7ios_base@std@@QEBA_NXZ ?_Xbad_function_call@std@@YAXXZ _Mtx_unlock _Query_perf_frequency ??1facet@locale@std@@MEAA@XZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ?uncaught_exceptions@std@@YAHXZ ?_Xbad_alloc@std@@YAXXZ ?_Xlength_error@std@@YAXPEBD@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?good@ios_base@std@@QEBA_NXZ _Strxfrm ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Throw_Cpp_error@std@@YAXH@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Id_cnt@id@locale@std@@0HA ?_Xout_of_range@std@@YAXPEBD@Z ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z ?_Winerror_map@std@@YAHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?id@?$ctype@D@std@@2V0locale@2@A ?id@?$collate@D@std@@2V0locale@2@A ?_Syserror_map@std@@YAPEBDH@Z _Strcoll _Cnd_do_broadcast_at_thread_exit _Thrd_detach ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ?tolower@?$ctype@D@std@@QEBADD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?tolower@?$ctype@D@std@@QEBAPEBDPEADPEBD@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

shlwapi

PathFileExistsA

winhttp

WinHttpQueryHeaders WinHttpAddRequestHeaders WinHttpOpen WinHttpReceiveResponse WinHttpWebSocketSend WinHttpReadData WinHttpQueryDataAvailable WinHttpOpenRequest WinHttpWebSocketReceive WinHttpCloseHandle WinHttpSendRequest WinHttpWebSocketClose WinHttpSetTimeouts WinHttpConnect WinHttpWebSocketCompleteUpgrade WinHttpSetOption

imm32

ImmSetCompositionWindow ImmReleaseContext ImmGetContext ImmSetCandidateWindow

dwmapi

DwmExtendFrameIntoClientArea

vcruntime140_1

__CxxFrameHandler4

vcruntime140

_CxxThrowException __intrinsic_setjmp __current_exception_context __current_exception __C_specific_handler memcmp memchr __std_terminate __std_exception_destroy __std_exception_copy strchr strstr wcsstr strrchr longjmp memcpy memmove memset

api-ms-win-crt-utility-l1-1-0

rand qsort srand

api-ms-win-crt-runtime-l1-1-0

_initterm_e exit _exit terminate _c_exit _register_thread_local_exe_atexit_callback _get_narrow_winmain_command_line _set_app_type _invoke_watson _seh_filter_exe abort _configure_narrow_argv _cexit _initterm _errno _wassert _initialize_narrow_environment _crt_atexit _register_onexit_function _beginthreadex _initialize_onexit_table

api-ms-win-crt-heap-l1-1-0

realloc free _set_new_mode malloc _callnewh

api-ms-win-crt-math-l1-1-0

roundf _dclass acosf sqrtf ceilf cosf fmodf pow sin sinf __setusermatherr _dsign

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-string-l1-1-0

strncmp tolower strcmp _stricmp strncpy

api-ms-win-crt-stdio-l1-1-0

fread fsetpos __stdio_common_vfprintf ungetc __acrt_iob_func ftell __stdio_common_vsprintf setvbuf fgetpos __stdio_common_vsnprintf_s fwrite _wfopen _get_stream_buffer_pointers __p__commode _set_fmode fgetc __stdio_common_vsprintf_s __stdio_common_vsscanf fputc fseek fclose fflush _fseeki64

api-ms-win-crt-convert-l1-1-0

strtod strtoll strtoull wcstombs_s strtol

api-ms-win-crt-environment-l1-1-0

getenv _dupenv_s getenv_s

api-ms-win-crt-filesystem-l1-1-0

_wremove _lock_file _unlock_file

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func localeconv _configthreadlocale